Eclipse Theia: Path Traversal (CVE-2026-60009)

What is affected, what to do

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication.

Update Eclipse Theia to version 1.74.0.

Affected

• Eclipse Theia lt *..1.74.0

Fixed in

• Eclipse Theia 1.74.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as `~/.bashrc`. Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.

Source: NVD (NIST), cvelistv5

Vendors and products

• Eclipse Foundation Eclipse Theia
• Eclipse Foundation Eclipse Theia

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

• CWE-73External Control of File Name or Path

  Base

  The product allows user input to control or influence paths or file names that are used in filesystem operations.

  Entry at MITRE CWE-73

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

• CWE-352Cross-Site Request Forgery (CSRF)

  Compound

  The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

  Entry at MITRE CWE-352

References & sources

• github.comeclipse-theia/theia/security/advisories/GHSA-62f6-wcvg-54h3Broken link
• gitlab.eclipse.orgsecurity/vulnerability-reports/-/issues/595Exploit, Mitigation, Vendor advisory
• gitlab.eclipse.orgsecurity/cve-assignment/-/work_items/177Vendor advisory
• gitlab.eclipse.orgsecurity/vulnerability-reports/-/work_items/595Exploit, Exploit, Mitigation, Vendor advisory

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 05.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   New references:

   • https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/595
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/595
   SSVC assessment	added	—	{"id":"CVE-2026-60009","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T12:36:40.861334Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 05.08.2026ReceivedEclipse

   CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

   Weakness type: CWE-352, CWE-22, CWE-306, CWE-73

   Description added or changed

   New references:

   • https://github.com/eclipse-theia/theia/security/advisories/GHSA-62f6-wcvg-54h3
   • https://gitlab.eclipse.org/security/cve-assignment/-/work_items/177
   • https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/595
   Show 10 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	Eclipse Theia
   Description	added	—	In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as `~/.bashrc`. Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.
   CVSS	added	—	AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
   Weakness type (CWE)	added	—	CWE-352
   Weakness type (CWE)	added	—	CWE-22
   Weakness type (CWE)	added	—	CWE-306
   Weakness type (CWE)	added	—	CWE-73
   Reference	added	—	https://github.com/eclipse-theia/theia/security/advisories/GHSA-62f6-wcvg-54h3
   Reference	added	—	https://gitlab.eclipse.org/security/cve-assignment/-/work_items/177
   Reference	added	—	https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/595

   Source identifier: emo@eclipse.org

2 NVD translations into other languages are hidden.